{"id":"CVE-2026-13462","aliases":["EUVD-2026-42637","GHSA-wpmg-2gv8-722g"],"status":"published","title":"PayRange for Android, version 7.0.7, contains an SSL bypass vulnerability","description":"PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00303,"percentile":0.23247,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-07-09T17:10:44Z","modified":"2026-07-09T21:32:26Z","products":[{"vendor":"payrange","product":"payrange"}],"references":[{"url":"https://cwe.mitre.org/data/definitions/295.html"},{"url":"https://kb.cert.org/vuls/id/152953"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13462"},{"url":"https://github.com/advisories/GHSA-wpmg-2gv8-722g"}],"sources":{"cve":[{"id":"CVE-2026-13462","title":"PayRange for Android, version 7.0.7, contains an SSL bypass vulnerability","description":"PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends.","status":"published","published":"2026-07-09T17:10:44.429Z","modified":"2026-07-09T19:45:55.644Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:19:49.885652Z"}],"euvd":[{"id":"EUVD-2026-42637","description":"PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends.","status":"published","published":"2026-07-09T17:10:44Z","modified":"2026-07-09T19:45:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:03.742277Z"}],"ghsa":[{"id":"GHSA-wpmg-2gv8-722g","title":"PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows...","description":"PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends.","status":"published","published":"2026-07-09T18:31:51Z","modified":"2026-07-09T21:32:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:09:22.189239Z"}],"nvd":[{"id":"CVE-2026-13462","description":"PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends.","status":"published","published":"2026-07-09T17:16:57.09Z","modified":"2026-07-09T20:16:28.637Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:28.4135Z"}]}}